In the field of antivirus protection for computers and enterprise networks, a file reputation service may be employed to check the legitimacy of certain files on user computers. Current file reputation services (or, file reputation technology) often use a cache mechanism to speed up response times. A file reputation service checks the reputation of a file against an extensive in-the-cloud database before permitting user access. The service uses high-performance content delivery networks and local caching servers in order to assure minimum latency during the checking process. Typically, the cache stored on the local, client-side is based upon queries sent to the file reputation service. But, this cache may be purged if many queries are sent or if there is an incomplete update; this presents a problem in that the cache is then not useful.
At the same time, though, the Internet network traffic being handled by the backend servers of a file reputation service is increasing dramatically in terms of incoming queries. Network traffic is increasing week-by-week and this means many thousands of dollars must be paid by the operator of the file reputation service to an Internet traffic company such as Akamai for the increase in traffic.
Using Akamai as an example (there are other such services) in the context of a file reputation service, the service may upload data to one Akamai server. Then, the Akamai server will distribute this data worldwide to Akamai servers. Finally, clients can access the nearest Akamai server to download what they need. Of course, all of this activity means increased network traffic and cost.
Network traffic usage is increasing not only because of more clients using the service, but also because of a limitation on the local client cache which requires a query to be sent out over the Internet to the backend servers. As mentioned above, this limitation is that the cache might be purged prematurely, and there is no quick and easy way to find out which items in cache should be kept without downloading them again and again.
Because a response from a backend server of the file reputation service may take more than 350 ms, while a response from a local client cache may take only 1 ms, it is important to make better use of a client cache instead of relying upon access to a backend server. To those ends, further techniques for better utilizing a local client cache in the context of a file reputation service or for any other suitable service are desired.